McAfee Virex for Mac Local Root Exploit and Scan Bypass (CVE-2007-1226/1227)

Critical Vulnerability Information Vulnerability Name: McAfee VirusScan for Mac (Virex) Local root exploit and Scan Bypass Discoverer: Kevin Finisterre CVE ID: CVE-2007-1226 Risk Level: High Local Vulnerability: No Remote Vulnerability: Yes Vulnerability Details Product Name: McAfee VirusScan for Mac (Virex) Product Version: <= Virex 7.7 Vulnerability Type: Local root exploit and Scan Bypass Exploitation Difficulty: Easy Technical Summary McAfee Virex includes a feature that allows users to define files to be excluded from scanning. This feature relies on a configuration file with insecure permissions located in /Library/Application Support. Any system user can modify or delete this configuration file, thereby affecting Virex's scanning behavior. Technical Details A vulnerability exists that can be exploited to gain root privileges on affected systems. The vulnerability resides in the functionality that allows users to define scan-excluded files. The configuration file used to store scan-excluded files has insecure "rw-rw-rw" permissions, allowing any user to modify or delete it. When the system starts, the VShieldCheck process, running with root privileges, verifies the existence of the VShieldExecute.txt file. If VShieldCheck cannot find the file at startup, it recreates it with rw-rw-rw permissions. Attackers can exploit this by creating symbolic links, thereby inserting arbitrary commands into newly created cron files that will execute with root privileges. Proof of Concept Netragard’s SNOsoft research team successfully exploited this issue to achieve privilege escalation and gain root access. Vendor Status Vendor Notification Date: 2007-06-11 Vendor Patch Release Date: 2007-07-13 Vendor Recommendations and Patch Release URL: - https://www.mcafee.com/...

Goal Reached Thanks to every supporter — we hit 100%!

McAfee Virex for Mac Local Root Exploit and Scan Bypass (CVE-2007-1226/1227)